Skip to content

Commit 737f92c

Browse files
paulbastianpaulbastian
authored
Merge branch 'main' into c2bo/fix-cwt-statuslist-encoding
2 parents a1b7e51 + 9940f55 commit 737f92c

File tree

1 file changed

+32
-38
lines changed

1 file changed

+32
-38
lines changed

‎draft-ietf-oauth-status-list.md‎

Lines changed: 32 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -605,6 +605,7 @@ A malicious Issuer could bypass the privacy benefits of the herd privacy by gene
605605
Once the Relying Party receives the Referenced Token, this enables him to request the Status List to validate its status through the provided `uri` parameter and look up the corresponding `index`. However, the Relying Party may persistently store the `uri` and `index` of the Referenced Token to request the Status List again at a later time. By doing so regularly, the Relying Party may create a profile of the Referenced Token's validity status. This behaviour may be intended as a feature, e.g. for a KYC process that requires regular validity checks, but might also be abused in cases where this is not intended and unknown to the Holder, e.g. profiling the suspension of a driving license or checking the employment status of an employee credential.
606606

607607
This behaviour could be mitigated by:
608+
608609
- adding authorization rules to the Status List, see [](#security-authorization).
609610
- regular re-issuance of the Referenced Token, see [](#implementation-lifecycle).
610611

@@ -648,14 +649,14 @@ IANA "JSON Web Token Claims" registry {{IANA.JWT}} established by {{RFC7519}}.
648649
* Claim Name: `status`
649650
* Claim Description: Reference to a status or validity mechanism containing up-to-date status information on the JWT.
650651
* Change Controller: IETF
651-
* Specification Document(s): [](#status-claim) of this specification
652+
* Specification Document(s): [](#status-claim) of this specification
652653

653654
<br/>
654655

655656
* Claim Name: `status_list`
656-
* Claim Description: A status list containing up-to-date status information on multiple other JWTs encoded as a bitarray.
657+
* Claim Description: A status list containing up-to-date status information on multiple tokens.
657658
* Change Controller: IETF
658-
* Specification Document(s): [](#status-list-token-jwt) of this specification
659+
* Specification Document(s): [](#status-list-token-jwt) of this specification
659660

660661
<br/>
661662

@@ -690,9 +691,9 @@ Specification Document(s):
690691
### Initial Registry Contents
691692

692693
* Status Method Value: `status_list`
693-
* Status Method Description: A status list containing up-to-date status information on multiple other JWTs encoded as a bitarray.
694+
* Status Method Description: A status list containing up-to-date status information on multiple tokens.
694695
* Change Controller: IETF
695-
* Specification Document(s): [](#referenced-token-jwt) of this specification
696+
* Specification Document(s): [](#referenced-token-jwt) of this specification
696697

697698
## CBOR Web Token Claims Registration
698699

@@ -707,15 +708,15 @@ IANA "CBOR Web Token (CWT) Claims" registry {{IANA.CWT}} established by {{RFC839
707708
* Claim Key: TBD (requested assignment 65535)
708709
* Claim Description: Reference to a status or validity mechanism containing up-to-date status information on the CWT.
709710
* Change Controller: IETF
710-
* Specification Document(s): [](#status-claim) of this specification
711+
* Specification Document(s): [](#status-claim) of this specification
711712

712713
<br/>
713714

714715
* Claim Name: `status_list`
715716
* Claim Key: TBD (requested assignment 65533)
716-
* Claim Description: A status list containing up-to-date status information on multiple other CWTs encoded as a bitarray.
717+
* Claim Description: A status list containing up-to-date status information on multiple tokens.
717718
* Change Controller: IETF
718-
* Specification Document(s): [](#status-list-token-cwt) of this specification
719+
* Specification Document(s): [](#status-list-token-cwt) of this specification
719720

720721
<br/>
721722

@@ -750,9 +751,9 @@ Specification Document(s):
750751
### Initial Registry Contents
751752

752753
* Status Method Value: `status_list`
753-
* Status Method Description: A status list containing up-to-date status information on multiple other CWTs encoded as a bitarray.
754+
* Status Method Description: A status list containing up-to-date status information on multiple tokens.
754755
* Change Controller: IETF
755-
* Specification Document(s): [](#referenced-token-cwt) of this specification
756+
* Specification Document(s): [](#referenced-token-cwt) of this specification
756757

757758
## Media Type Registration
758759

@@ -766,15 +767,13 @@ To indicate that the content is an JSON-based Status List:
766767
* Subtype name: statuslist+json
767768
* Required parameters: n/a
768769
* Optional parameters: n/a
769-
* Encoding considerations: binary; A JSON-based Status List is a JSON Object.
770-
* Security considerations: See (#Security) of \[ this specification \]
770+
* Encoding considerations: See [](#status-list-json) of this specification
771+
* Security considerations: See [](#Security) of this specification
771772
* Interoperability considerations: n/a
772-
* Published specification: \[ this specification \]
773-
* Applications that use this media type: Applications using \[ this specification \] for updated status information of tokens
773+
* Published specification: this specification
774+
* Applications that use this media type: Applications using this specification for updated status information of tokens
774775
* Fragment identifier considerations: n/a
775-
* Additional information:
776-
* File extension(s): n/a
777-
* Macintosh file type code(s): n/a
776+
* Additional information: n/a
778777
* Person &amp; email address to contact for further information: Paul Bastian, paul.bastian@posteo.de
779778
* Intended usage: COMMON
780779
* Restrictions on usage: none
@@ -788,15 +787,13 @@ To indicate that the content is an JWT-based Status List:
788787
* Subtype name: statuslist+jwt
789788
* Required parameters: n/a
790789
* Optional parameters: n/a
791-
* Encoding considerations: binary; A JWT-based Status List is a JWT; JWT values are encoded as a series of base64url-encoded values (some of which may be the empty string) separated by period ('.') characters.
792-
* Security considerations: See (#Security) of \[ this specification \]
790+
* Encoding considerations: See [](#status-list-token-jwt) of this specification
791+
* Security considerations: See [](#Security) of this specification
793792
* Interoperability considerations: n/a
794-
* Published specification: \[ this specification \]
795-
* Applications that use this media type: Applications using \[ this specification \] for updated status information of tokens
793+
* Published specification: this specification
794+
* Applications that use this media type: Applications using this specification for updated status information of tokens
796795
* Fragment identifier considerations: n/a
797-
* Additional information:
798-
* File extension(s): n/a
799-
* Macintosh file type code(s): n/a
796+
* Additional information: n/a
800797
* Person &amp; email address to contact for further information: Paul Bastian, paul.bastian@posteo.de
801798
* Intended usage: COMMON
802799
* Restrictions on usage: none
@@ -810,15 +807,13 @@ To indicate that the content is an CBOR-based Status List:
810807
* Subtype name: statuslist+cbor
811808
* Required parameters: n/a
812809
* Optional parameters: n/a
813-
* Encoding considerations: binary; A CBOR-based Status List is a CBOR Object.
814-
* Security considerations: See (#Security) of \[ this specification \]
810+
* Encoding considerations: See [](#status-list-cbor) of this specification
811+
* Security considerations: See [](#Security) of this specification
815812
* Interoperability considerations: n/a
816-
* Published specification: \[ this specification \]
817-
* Applications that use this media type: Applications using \[ this specification \] for updated status information of tokens
813+
* Published specification: this specification
814+
* Applications that use this media type: Applications using this specification for updated status information of tokens
818815
* Fragment identifier considerations: n/a
819-
* Additional information:
820-
* File extension(s): n/a
821-
* Macintosh file type code(s): n/a
816+
* Additional information: n/a
822817
* Person &amp; email address to contact for further information: Paul Bastian, paul.bastian@posteo.de
823818
* Intended usage: COMMON
824819
* Restrictions on usage: none
@@ -832,15 +827,13 @@ To indicate that the content is an CWT-based Status List:
832827
* Subtype name: statuslist+cwt
833828
* Required parameters: n/a
834829
* Optional parameters: n/a
835-
* Encoding considerations: binary;
836-
* Security considerations: See (#Security) of \[ this specification \]
830+
* Encoding considerations: See [](#status-list-token-cwt) of this specification
831+
* Security considerations: See [](#Security) of this specification
837832
* Interoperability considerations: n/a
838-
* Published specification: \[ this specification \]
839-
* Applications that use this media type: Applications using \[ this specification \] for updated status information of tokens
833+
* Published specification: this specification
834+
* Applications that use this media type: Applications using this specification for updated status information of tokens
840835
* Fragment identifier considerations: n/a
841-
* Additional information:
842-
* File extension(s): n/a
843-
* Macintosh file type code(s): n/a
836+
* Additional information: n/a
844837
* Person &amp; email address to contact for further information: Paul Bastian, paul.bastian@posteo.de
845838
* Intended usage: COMMON
846839
* Restrictions on usage: none
@@ -876,6 +869,7 @@ for their valuable contributions, discussions and feedback to this specification
876869
-04
877870

878871
* fix CWT status_list map encoding
872+
* editorial fixes
879873
* add CORS considerations to the http endpoint
880874
* fix reference of Status List in CBOR format
881875
* added status_list CWT claim key assigned

0 commit comments

Comments
 (0)